What IT policies are required by law?

No single law mandates a fixed list, but data privacy laws (GDPR, and equivalent regimes elsewhere) effectively require a data privacy policy and a data retention policy for any organisation handling personal data. Regulated sectors – financial services, healthcare – typically have additional sector-specific requirements layered on top.